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REMARKS 

This Application has been carefully reviewed in light of the Final Office Action 
mailed May 4, 2005. Applicant appreciates the Examiner's consideration of the Application. 
Claims 1-2, 7-12, and 17-18 have been amended to clarify, more particularly point out, and 
more distinctly claim inventive concepts previously present in these claims. Certain 
amendments do not narrow the scope of the claims, and certain amendments are not required 
for patentability. Applicant respectfully submits that no new matter has been added by the 
amendments to the claims. In order to advance prosecution of this Application, Applicant has 
responded to each notation by the Examiner. Applicant respectfully requests reconsideration 
and favorable action in this case. 

Applicant believes that the amendments place the case in condition for allowance or 
in better condition for appeal, do not raise the issue of new matter, and do not present new 
issues requiring further consideration or search. Accordingly, Applicant respectfully requests 
that the Examiner enter the amendments. 

Section 102 Rejection 

The Examiner rejects Claims 1-18 under 35 U.S.C. § 102(b) as being unpatentable 
over U.S. Patent No. 6,357,008 to Nachenburg ("Nachenburg"). Applicant respectfully 
traverses this rejection for the reasons discussed below. 

Nachenburg discloses a method for detecting computer viruses. According to 
Nachenburg: 

[The method comprises] three phases: a decryption phase, an 
exploration phase, and an evaluation phase. A purpose of the decryption phase 
is to emulate a sufficient number of instructions to allow an encrypted virus to 
decrypt its viral body. A purpose of the exploration phase is to emulate at least 
once all sections of code within a region deemed likely to contain any virus 
present in the target program. A purpose of the evaluation phase is to analyze 
any suspicious behavior observed during the decryption and exploration 
phases to determine whether the target appears to be infected. 

(Nachenburg, Abstract.) 

Applicant respectfully submits that Nachenburg fails to disclose, or even teach or 
suggest, the elements specifically recited in Applicant's claims. For example, Nachenburg 
fails to disclose, teach, or suggest "triggering a viral detection alarm, if one of the listed 
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memory regions is larger than a predetermined size, the viral detection alarm indicating 

detection of viral code," as recited in amended independent Claim 2. 

The Examiner relies on the passages at column 8, lines 1-7 of Nachenburg to teach 

"triggering a viral detection alarm, if one of the listed memory regions is larger than a 

predetermined size." (Office Action, page 3, paragraph 1.) The Nachenburg passages 

disclose determining whether a region of a minimum size or larger has been decrypted: 

On the other hand, if the first threshold number has been reached, then 
the decryption module 152 determines in a fourth procedure 308 whether a 
region of a certain minimum size or larger appears to have been decrypted. 

{Nachenburg, column 8, lines 1-4.) If a region of a minimum size or larger has not been 

decrypted, the exploration phase is initiated: 

If no such region appears to have been decrypted, then under the assumption 
that any virus present is unlikely to be an encrypted virus, the decryption 
phase 252 ends and the exploration phase 254 begins. 

{Nachenburg, column 8, lines 9-13.) If a region of a minimum size or larger has been 

decrypted, the decryption phase continues: 

On the other hand, if such a region appears to have been decrypted, 
then emulation in the decryption phase 252 continues to allow further 
decryption by fetching the instruction at the virtual CS:IP in the sixth 
procedure 312 unless a second threshold number of emulated instructions has 
been reached. 

{Nachenburg, column 8, lines 14-18.) 

That is, the passages of Nachenburg disclose determining whether a region of a 
minimum size has been decrypted, initiating the exploration phase if a region of a minimum 
size or larger has not been decrypted, and continuing the decryption phase if a region of a 
minimum size or larger has been decrypted. The Nachenburg passages, however, fail to 
disclose, teach, or suggest "triggering a viral detection alarm, if one of the listed memory 
regions is larger than a predetermined size, the viral detection alarm indicating detection of 
viral code," as recited in amended independent Claim 2. For at least these reasons, 
Nachenburg fails to disclose, teach, or suggest the elements specifically recited in Claim 2. 

Independent Claims 1, 7-12, and 17-18 recite certain limitations substantially similar 
to those recited in independent Claim 2. Accordingly, for at least the same reasons, 
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Applicant also respectfully requests reconsideration and allowance of independent Claims 1 , 
7-12, and 17-18. 

The dependent claims are allowable based on their dependence on the independent 
claims and further because they recite numerous additional patentable distinctions over the 
reference of the rejection. Because Applicant believes he has amply demonstrated the 
allowability of the independent claims over the reference of the rejection, and to avoid 
burdening the record, Applicant has not provided detailed remarks concerning these 
dependent claims. Applicant, however, remains ready to provide such remarks if it becomes 
appropriate to do so. Accordingly, for at least the same reasons, Applicant also respectfully 
requests reconsideration and allowance of the claims that depend on independent Claims 1-2, 
7-12, and 17-18. 
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CONCLUSION 

Applicant has made an earnest attempt to place this case in condition for allowance. 
For at least the foregoing reasons, Applicant respectfully requests full allowance of all the 
pending claims. 

If the Examiner believes a telephone conference would advance prosecution of this 
case in any way, the Examiner is invited to contact Keiko Ichiye, the Attorney for Applicant, 
at the Examiner's convenience at (214) 953-6494. 

Although Applicant believes no fees are due, the Commissioner is hereby authorized 
to charge any fees or credit any overpayments to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 

Respectfully submitted, 

BAKER BOTTS L.L.P. 
Attorneys for Applicant 

Keiko Ichiye 
Reg. No. 45,460 


Kl/ls 
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2001 Ross Avenue, Suite 600 

Dallas, Texas 75201-2980 
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